6.10 Vulnerability handling and disclosure

Requirement

The relevant entities shall obtain information about technical vulnerabilities in their network and information systems, evaluate their exposure to such vulnerabilities and take appropriate measures to manage the vulnerabilities.

Guidance

• Adopt a framework for assessing the severity of vulnerabilities based on models (e.g. CVSS, exploit prediction scoring system (EPSS) or SANS vulnerability assessment framework) and supplemented by environmental and threat metrics as appropriate.

Examples of evidence

• Documentation of a risk-assessment framework used to evaluate the severity, impact and probability of exploitation of identified vulnerabilities (e.g. CVSS scores).

Requirement

For the purpose of point 6.10.1., the relevant entities shall: (a) monitor information about vulnerabilities through appropriate channels, such as announcements of CSIRTs, competent authorities or information provided by suppliers or service providers; (b) perform, where appropriate, vulnerability scans and record evidence of the results of the scans, at planned intervals; (c) address, without undue delay, vulnerabilities identified by the relevant entities as critical to their operations; (d) ensure that their vulnerability handling is compatible with their change management, security patch management, risk management and incident management procedures; (e) lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy.

Guidance

• As a minimum, address vulnerabilities assigned to higher classifications (e.g. ‘critical’ and ‘high’ in the CVSS) or equivalent (e.g. as defined by the national CSIRT) without undue delay. Where possible, accepting the risk of such vulnerabilities and not addressing them is not advisable.
• Share information obtained from technical vulnerability scans with designated personnel throughout the entity and with authorities to help eliminate similar vulnerabilities in other information systems.
• Disclose as yet unknown vulnerabilities to designated CSIRTs in accordance with national coordinated vulnerability disclosure (CVD) policies, where applicable.
• Identify a single point of contact and channels for communication with suppliers and service providers about issues related to network and information security.

Examples of evidence

• Logs of a vulnerability assessed as critical to check if it was addressed.
• Licences or subscriptions for vulnerability-scanning tools.
• Configuration files of the vulnerability-scanning tools to ensure they are set up to scan the entire relevant infrastructure and are updated with the latest vulnerability definitions.
• Logs from vulnerability management tools showing scan schedules, results and follow-up actions.
• Documented technical vulnerability scan reports.
• SIEM and EDR/XDR logs for records of detected vulnerabilities and related alerts from monitoring channels.
• Reports from third-party security assessments or penetration tests.
• For vulnerabilities assessed as critical, evidence that findings from these assessments have been addressed.
• Records of any vulnerabilities disclosed, in accordance with the national CVD policy.
• Interview with the single point of contact and channels for communication with suppliers and service providers about information-security-related issues.

Requirement

When justified by the potential impact of the vulnerability, the relevant entities shall create and implement a plan to mitigate the vulnerability. In other cases, the relevant entities shall document and substantiate the reason why the vulnerability does not require remediation.

Guidance

• Ensure comprehensive documentation of identified vulnerabilities, the associated risk assessments and any mitigation plans developed.
• Define and establish the roles and responsibilities associated with vulnerability management.
• Mitigation plans should include clear timelines, assigned responsibilities and follow-up procedures.
• All mitigation plans, along with the rationale for non-remediation decisions, should be reviewed and validated by the management body responsible for risk oversight

Examples of evidence

• Records showing timelines and responsible employees for each remediation effort and verification of fixes.
• Records or logs of past vulnerability mitigation plans or schedules.
• Records of any vulnerability that was not addressed and the justification for not addressing it.

Requirement

The relevant entities shall review and, where appropriate, update at planned intervals the channels they use for monitoring vulnerability information.

Guidance

• Review the information from the technical-vulnerability-monitoring channels at least biannually.
• Consider inventorying sources likely to report technical vulnerabilities in the identified components and distribute updates (software publisher websites, CERT website and ENISA website) (71).

Examples of evidence

• List of monitoring channels for technical vulnerabilities, including suppliers and service providers’ single points of contact.
• Records of past reviews and plans for future reviews of technical vulnerability channels.
• Subscriptions to relevant vulnerability notification services, mailing lists and alert systems (e.g. CERT, vendor advisories and security forums).
• Logs that document periodic reviews of the monitoring channels to verify that they are up to date and effective.
• Records of alerts or notifications received from monitoring channels about new vulnerabilities, including how these alerts were handled and any subsequent actions taken.
• Logs that record the monitoring activities for vulnerability information, including dates and sources monitored (e.g. security advisories, vendor bulletins, threat intelligence feeds).

Tips: guidance

• Create and maintain procedures for identifying, assessing, prioritising and remediating vulnerabilities.
• Make sure that suppliers and service providers report vulnerabilities in their systems or products or services that present a risk to the security of the network and information systems of the entity.
• Perform vulnerability scans and record evidence of the results of the scans, when significant incidents or significant changes to operations or risks occur.
• Where possible, consider authenticated vulnerability or an alternative method to perform in depth scans.
• Review and, where appropriate, update the channels for monitoring vulnerability information when significant incidents or significant changes to operations or risks occur.

Tips: examples of evidence

• Documented procedures for identifying, assessing, prioritising and remediating vulnerabilities.
• Contracts with suppliers and service providers that require technical vulnerability reporting, handling and disclosure.
• Vulnerability-related communications or reports from suppliers and service providers.
• Records of ad-hoc scans performed in response to significant incidents or changes to the infrastructure, including the dates and reasons for these scans.
• Change management logs to verify that vulnerability scans are conducted following significant incidents or changes to the infrastructure or to the threat landscape.
• Records of internal audits or reviews of the vulnerability management procedures.
• Findings and corrective actions taken from these audits.